1. Field
The present inventive concept pertains to a system and method to classify software intent. The present inventive concept more particularly concerns a system and method to classify software intent based on extracting and utilizing disassembly characteristics as features in a machine learning context.
2. Discussion of Related Art
To maintain security, security software configured for use with a computer system analyzes system software and attempts to differentiate malware or malicious software from benign software. Conventional security software, however, often misclassifies malicious software as benign software or vice versa.
Conventional processes to classify malicious software include analyzing features of software such as its file size, file entropy, portable executable file attributes, and file structure. This approach is problematic because these features can be manipulated by an author of the malicious software, which is likely to confuse the identification process, thereby preventing or delaying accurate identification of malicious software.
Thus, there is a need for a system and method that provides improved classification of system software, and reduces confusion introduced by malicious software and malicious software authors or resulting from benign activities that can affect features such as those described above.